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Keep this secret, please 


Security by obscurity is known to be an unreliable 
strategy. The failure of this strategy has now 
completely corrupted our IT infrastructure. 
Spoiler: don’t expect a happy end. 


Once upon a time in the west, there was a security agency that thought 
it was a clever idea to actively search for, collect and create a multi-mil- 
lion market for so-called 0-day exploits: security holes in widely used 
software such as Windows, Linux, MacOS, Chrome, Word, Excel, and 
many others. These exploits were completely new and had never been 
exploited before (hence the zero). They are ideal for penetrating the 
enemy's IT systems. This agency was not just an agency; it was the 
National Security Agency (NSA), the most secretive of all security agen- 
cies worldwide. 


In 2013, Edward Snowden revealed the worldwide espionage activities 
of the NSA, including the unconstitutional espionage on US citizens on 
US territory. The repercussions for the NSA were dramatic but paled 
into significance compared to the announcement in 2016 by a group 
called Shadowbrokers that they had stolen and would make public the 
entire treasure trove of 0-day exploits collected by the NSA over the 
years. And they did. Every nation state or criminal organisation world- 
wide could now use these tools for their own goals, ranging from espi- 
onage to cyber extortion. This became standing practice, which exists 
until today. Russian actors can directly control physical systems from 
the power grid in Ukraine to nuclear power plants and oil pipelines in 
the US. North Koreans collect millions of dollars in Bitcoin by encrypt- 
ing the data of thousands of municipalities and companies worldwide 
and extorting them. Ransomware-as-a-service is commercially available 
today, including, unbelievable as it might sound, an ethical code of con- 
duct and a help desk. Actors from China, Iran, and Eastern Europe have 
been identified carrying out similar activities. 


Keeping a secret is hard for many reasons, and in the end, most 

secrets are revealed. Building your security strategy on secrets presents 
a significant hazard. The same is true when combatting criminality 

and terrorism: the regularly proposed (and hotly contested) idea of 

a government backdoor in our phones and laptops creates another 
secret waiting to be exposed. Don't do that. 


The problem we are facing is so gigantic that it seems to require a 
complete redesign or at least rethinking of our computing and commu- 
nication infrastructure. That is not something which can be realised 
overnight. Research suggestions and clever ideas are urgently needed. 
If the above did make you nervous, then read the full story about the 
cyber-weapons arms race in Nicole Perlroth’s book entitled ‘This is how 
they tell me the world ends’, Bloomsbury Publishing, 2021. This is com- 
pulsory reading for anyone involved in IT in a professional, or even 
better: governmental, role. It is a good, extremely informative read. 
But beware: there is no happy end. 


.STOP FIXING — 
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How to improve the 
recruitment, onboarding 
and promotion of 
women in computer 
science? The IPN 
working group on Equity, 
Diversity and Inclusion 
recently published a 


report with five practical 
recommendations. 
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Professor Marieke Huisman from the University of 
Twente had her first child in France and her second in 
the Netherlands. She was struck by how differently 
people in the two countries reacted to the 
announcement of her pregnancy. Huisman: ‘In France, 
the first question people asked me was: “Have you 
already arranged for a place in the nursery?”. The 
implicit assumption was that you would continue 
working. In the Netherlands, | was asked: “How many 
days will you continue to work?” That is typical of the 
part-time culture among women that is seen as the 
norm in the Netherlands.’ 


Marieke Huisman 


‘No professor is 
against diversity, but 


it's about what's 
actually being done 
to make it happen’ 


Childcare is one of many examples of obstacles for 
women in science. On behalf of the IPN working group 
on Equity, Diversity and Inclusion, Huisman and fellow 
professor Alexander Serebrenik from Eindhoven 
University of Technology prepared a report on the 
recruitment, onboarding and promotion of women in 
academic computer science research. Specifically, they 
looked at women working as assistant, associate or full 
professors. 


Five topics 


For the report, they spoke between November 2020 
and January 2021 with 15 representatives from all 
Dutch universities with a computer science degree and 
Centrum Wiskunde & Informatica (CWI). Eleven of them 
were women and four were men. The result is the 
report ‘Women in Dutch Computer Science: Best 
Practices for Recruitment, Onboarding and Promotion’, 
which lists five key recommendations (see box). ‘Initially, 
we focused on three topics’, Serebrenik explains. 
‘Recruiting, onboarding and promoting. Two additional 
topics emerged from the conversations: parenting and 
awareness of diversity.’ 


‘In terms of diversity awareness, quite a lot is already 
happening, but we still want to urge the computer 
science community to do more’, says Huisman. ‘For 
example, it’s not just about hiring more women; it’s also 
about making them feel included. So, in addition to 
diversity, it’s about inclusivity. Something like maternity 


leave should be well organised and not be something 
one has to fight for.’ 


Huisman says that while the importance of diversity has 
really sunk in among department heads, the crux is in 
taking concrete steps on the work floor. ‘No professor is 
against diversity, but it’s about what's actually being 
done to make it happen.’ Often you hear a ‘yes, but...’, 
Serebrenik adds. ‘Yes, we want more women, but we 
can't find them. Yes, we want more women, but they 
don't apply. The blame then always lies with the women, 
and that is unjustified.’ 


Serebrenik’s scientific specialisation is social software 
engineering. For example, he studies how diversity in 
software development teams affects the process and 
the result. Even though that isn’t exactly the same as 
the functioning of a computer science department at a 
university, from his research, he nevertheless concludes 
that diversity makes a substantive difference. 
Serebrenik: ‘In software development teams, we clearly 
see that diversity positively affects both the process and 
the outcome. When you invest in diversity, you are 
indirectly investing in better quality software.’ 


Advertisements aimed at recruiting women need to be 
formulated in gender-neutral language, should not 
emphasise excellence, and should explicitly encourage 
women to apply. Huisman: ‘Research has shown that 
women are more likely than men to be put off by ads 
that emphasise a competitive spirit. It’s a classic 
prejudice, yet | often see it in practice. If there is a list 
of ten requirements that an applicant must meet, 

a woman is more likely to think “I can only do six”, while 
aman is more likely to think “I meet three, but I'll learn 


wt 


the other seven”. 


To feel truly included in a new organisation, many women 
find it helpful to have a female mentor to show them the 
way. ‘But this mentoring task must then be seen as work’, 
says Serebrenik, ‘and not as something that comes as 

an addition to regular work. If a senior woman is given 

a mentoring task, then that should automatically mean 
that something goes off from other tasks.’ 


Clear criteria 


Decisions about whether or not a person gets 
promoted need to be made transparent, is another 
recommendation in the report. Serebrenik: ‘Our inter- 
viewees indicated that it is not always clear what criteria 
promotion decisions are based on. On the other hand, 
sometimes the criteria are explicit, but there are so 
many that no one can reasonably meet them. Both 
unclear criteria and too many criteria create a lot of 
stress and uncertainty. Being clear about the criteria for 
promotion benefits people of any gender, but because 
women are less likely to feel that they meet certain 
criteria, a lack of clarity affects them more.’ 


Diversity 


Alexander Serebrenik ALICE AND EVE EVENT 


‘We all benefit from : Alice & Eve 2021 is a workshop for celebrating 
diversity, and we all women in computing in the Netherlands. It aims 
bear responsibility to bring together talents in the field of 
for it, scientists but he computing. The first edition took place in 2020. 
The second edition will be hosted in November 
2021 by Radboud University. In addition to 
keynote talks and posters, there will be an 


also the support staff 


exhibition which portrays women in computing 


The report ‘Women in Dutch Computer Science: Best and their most important contributions. For the 
Practices for Recruitment, Onboarding and Promotion’ Alice & Eve exhibition, a booklet is being 

has been presented to IPN. It will also be distributed to 
the heads of the computer science faculties at Dutch 
universities and CWI, and to NWO. Later this year, 
Huisman and Serebrenik plan to sit down with the science: Alice & Eve: A Celebration of Women in 
department heads to discuss what they plan to do with Computing. Amongst other things, it highlights 
the report. ‘It’s not that everyone has to implement 
everything right away’, Huisman says, ‘but we want 


them to think about it and see what they can improve : A 
in their own departments.’ Frances Brazier and Felienne Hermans. 


published that describes the pivotal role of 
twenty-five women in the field of computer 


the work of some well-known Dutch female 
computer scientists such as Linda van der Gaag, 


Serebrenik wants to emphasise that when we talk aliceandeve.cs.ru.nl 
about women in computer science, we are not talking 

about a problem of women: ‘It’s a problem of the 

computer science community in the broadest sense. 

We all benefit from diversity, and we all bear responsi- 


bility for it, scientists but also the support staff.’ 0 a ay 
“em 
5 5 Tht S- 7 
And though for the current report, Huisman and depen, 1. , 


Serebrenik may have looked specifically at the position 7 : Oe 
of women, the IPN working group on Equity, Diversity - 
and Inclusion certainly wants to look at diversity ina te) eF 
broader sense as well. Huisman: ‘Diversity is also about . 

different cultural and ethnic backgrounds, about 

migrants and about different socioeconomic environ- E 4 P's, 


ments. We want to make it clear that computer science aa a | 
is there for them too.’ = ae s 


e ¥: 
Recommendations = 


1. Create awareness among scientific and support staff 
of the importance of diversity among employees of 
all genders and seniorities. 


. Recruitment messages should be gender-neutral, 
should not stress excellence and should explicitly 
encourage women to apply. 


. Mentoring should be a mandatory element of the 
onboarding. 


. Transparency in tenure and promotion decisions is 
crucial. 


. Support for maternity leave, parental leave and 
childcare should be improved. 


The report can be found online at 
ict-research.nl/edi-working-group/outcomes/ 


| Research 


MODELLING 
COMPLEX 
SOFTWARE 
SYSTEMS 


Onder Babur is developing new techniques to 
deal with the ever-increasing complexity of 
software. Instead of working on yet another 
model to develop software, he is trying to 
understand, construct and manage the 


ecosystem of different models as a whole. 


By Bennie Mols 
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As software systems are getting ever more ubiquitous, larger, 
more complex and multidisciplinary, they become increasingly 
difficult to understand and manage. Also, for decades, models 
have been developed that are specific to a certain domain, 
such as automotive or cyber-physical systems. 

During his PhD research at Eindhoven University of 
Technology, Onder Babur collected hard evidence that this 
modelling effort itself is getting out of hand. ‘The ecosystem 
of models is getting more and more complex itself’, says 
Babur. ‘When | started my research, the experts | talked to 
didn't even realise that this is a problem. But the evidence | 
collected from open source software and from software used 
by companies in the Eindhoven area clearly showed that the 
modelling ecosystems contain hundreds to thousands of 
different models in many languages and domains.’ 


Next, Babur developed techniques inspired by information 
retrieval and machine learning to understand, construct and 
manage the growing complexity of the modelling ecosystem. 
Babur: ‘Software models often use bits and pieces from previ- 
ously developed models. We call this cloning. It doesn’t have 
to be a problem, but it often is. So, | developed techniques 
that can find, inspect, improve or remove such cloning.’ 


IMMERSED IN ASML 


During his PhD research, Babur collaborated with ASML, the 
Dutch multinational that manufactures photolithography 
machines for the production of computer chips. ‘Their 
machines are huge and very complex’, says Babur, ‘and so is 
the software that runs on these machines. Interestingly for us, 
ASML is a proponent of model-driven software engineering. 
They use a lot of modelling to handle the complexity of the 
software. The many models that the company uses span 
multiple domains and languages, are developed by different 
teams or outsourced to other companies, and are changing 
over time. My aim was to explore whether we could analyse 
this complex ecosystem using the approach | was developing 
in my PhD research.’ 


Babur worked for one day a week inside ASML and involved a 
master’s student to help him. The collaboration resulted in 
some concrete ideas that ASML could use to automate the 
analysis of their complex modelling ecosystem. 


Babur defended his PhD thesis at the start of 2019 and did 

a postdoc after that. He used the insights from the ASML 
collaboration to convince colleagues in the field of the impor- 
tance of his meta-analysis of domain-specific models. ‘And 
recently this approach is indeed getting more attention’, he 
concludes happily. 


In April of this year, Babur started to work as a lecturer at 
Wageningen University & Research, where he applies his 
expertise in software modelling to the life, agricultural and 
environmental sciences. ‘One of my new collaborations 
involves a digital twin model applied in the field of nature 
conservation. In the future, | am also going to focus more on 
building Al assistants that can help modelling systems.’ 


DCYPHER 
REVITALISED 


dcypher, the Dutch cybersecurity 
platform higher education & 
research, was discontinued on 

1 October 2020. Since then, several 
government ministries have been 
setting up a new platform. The 
recently formed platform board 
has decided to breathe new life 
into dcypher and keep the name. 
In the meantime, a group of 
researchers announced the estab- 
lishment of an association for 
scientists active in the multidisci- 
plinary field of Cybersecurity in the 
Netherlands. The name of the 
association is ACCSS (pronounce 
access, ACademic cybersecurity 
Society). The association in 
formation is also continuing a few 
activities from the former dcypher, 
such as the annual presentation of 
the Dutch Cybersecurity Best 
Research Paper Award. 


More information can be found at 
dcypher.nl and accss.nl/en 


IPN/NWO news 


TWO COMPUTER SCIENTISTS 


ELECTED KNAW MEMBER 


The Royal Netherlands Academy of Arts 
and Sciences (KNAW) has elected 23 new 
members, including two computer scien- 
tists. Thomas Back (1963), Professor for 
Natural Computing at Leiden University, is 
the founder of evolutionary computation, 

a subfield of mathematics that draws inspi- 
ration from evolutionary biology to find the 
best solution to a given problem. Rineke 
Verbrugge (1965), Professor in Logic and 
Cognition at the University of Groningen 
devotes many of her publications to 


intelligent interaction. 


She has developed a well- 
known game that combines 


logic, game theory and 


cognitive psychology. They 
will be installed on Monday 


13 September 2021. 


TEN MILLION FOR SOLVING 
CYBERSECURITY ISSUES 


Within the Dutch Research Agenda 
(NWA) programme Cybersecurity - 
Towards a secure and trustful digital 
domain, five proposals have been 
awarded from consortia that will 
investigate cybersecurity: three pro- 
jects will focus on governance, and 
two will also focus on cryptologic 
aspects. The total research budget 
amounts to circa 10 million euros. 
Research into the governance aspects 
of cybersecurity focuses on the entire 
knowledge chain in which all science 
domains, vital infrastructures and 
liability regimes are involved. This 
includes research into legislation and 
into (international) standards and 
norms for a more secure cyberspace. 
For instance, one project will investi- 
gate how we can patch security leaks 
in software on time. Another project 


will establish ways to stave off the risk 


of quantum computers cracking 
encryption schemes. 


GRANTS FOR SCIENTIFIC 
INFRASTRUCTURE 


NWO is investing 20 million euros in 
seven projects for innovative scientific 
infrastructure. These NWO Invest- 
ment Grant Large awards will be used 
to acquire high-value equipment, data 
collections and software. With these 
awards, NWO is strengthening the sci- 
entific infrastructure that Dutch 
knowledge institutions can make 
available to the Dutch research com- 
munity. One of the awarded projects 
is in the field of digital humanities. 
The project Globalise, led by Matthias 
Van Rossum of the International Insti- 
tute of Social History, will develop new 
digital research tools for Dutch East 
India Company (VOC) archives. 
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PELS RIJCKEN: 
WHERE ICT MEETS LAW 


In data and digitalisation, two aspects are inevitable: technology and law. Those 
worlds seldom meet. This is, however, not the case with law firm Pels Rijcken in 
The Hague, which has ICT law among its specialisations. Senior associate Jeroen 
Naves: ‘It is advisable to involve legal knowledge early on in ICT development. 


By Leendert van der Ent |mage iStock 


‘ICT developers and lawyers speak different 
languages’, Jeroen Naves says. ‘You can take that 
literally, as | noticed in a meeting between lawyers 
and developers on smart contracts some years 
ago. It took both parties two days of being at cross 
purposes before the eureka moment of realisation 
that we were talking about different meanings. 


| always imagined that a smart contract was 
something like a self-executing contract with the 
terms of the agreement being directly written into 
lines of code. However, for blockchain developers, 
it is the code connected to the blockchain. In that 
sense, the term is not necessarily describing a 
legally binding contract. It was quite an eye- 
opener and taught me that it’s useful to learn the 
developer's language.’ 


This anecdote underlines the importance of 
knowing both worlds. ‘We have to because we 
advise our clients on data exchange and 
innovation. They need to see technology in 
perspective and want to know about the legal 
consequences of technological development’, 
Naves comments. That is why, for example, we 
are actively involved in the Dutch Blockchain 
Coalition, and our managing partner Sandra van 
Heukelom formerly presided the steering 


committee. Likewise, we are involved in ECP, the 
platform for the information society.’ Pels Rijcken 
also works with TU Delft on blockchain, has 
projects going on with Tilburg University, and 
collaborates with TNO, where the law firm is repre- 
sented in the strategic advisory board (SAR) of the 
Unit Information & Communication Technology. 
Apart from consultancy, Pels Rijcken also 
specialises in licence agreements, guidance of ICT 
contracts and representation of clients in disputes 
and trials. 


‘Typically’, says Naves, ‘ICT developers start to work 
on applications without involving lawyers or, if 
they do involve them, only at a fairly late stage. 
When these lawyers are finally consulted, they will 
elaborate on what is forbidden. At our firm, we 
like to reverse things. We hope to be involved early 
on so that we can inform developers from the 
outset about what they need to take into account 
legally. And we stress the opportunities within the 
legal framework. If you only look into your rear- 
view mirror as a lawyer, then you will say “no” too 
easily. If instead, you look ahead and understand 
the technological basics, then you can inform your 
clients about the opportunities.’ 


When we discuss data, then more often than not, 
privacy is the key legal issue. ‘That was the case 
with the Dutch Ministry of Health, Welfare and 
Sport's app Coronamelder (COVID-19 contact 


warning). When you think about storage, 
encryption, architecture and specialised legal 
knowledge in a combined approach, you consid- 
erably enlarge the chances of success.’ 


When it comes to blockchain, Artificial Intelligence 
also comes into play. On 21 April, the European 
Commission proposed the first-ever legal 
framework on Al in the world. That is incredibly 
important for all technicians involved in this field. 
A simple example is that certain applications for 
face recognition are forbidden, but there are also 
more complex matters regarding the connection 
of datasets.’ 


ICT in business 


SCRAPING DATA 


‘We often see that data analysts in enterprise and 
government go after information by combining 
their own datasets with data “scraped” from a 
myriad of sources. When many sources are 
combined, it becomes hard to unravel the precise 
origin of the data. But personal data can only be 
used within the framework of the execution of 
certain narrowly described tasks. 


Furthermore, there are rules on scraping data; you 
cannot simply use everything you can lay your 
hands on. So ask your lawyer beforehand about 
what is and is not allowed.’ 

Governments using algorithms face challenges in 
the field of transparency. Naves gives an example: 
‘Municipalities use tools to define the value of real 
estate for property tax. In principle, that’s fine - 
but these tools are often commercial. As a result, 
the developer will not disclose how they work 
because his business model depends on that 
remaining a secret. And taxation based on a black- 
box methodology has been struck down by judges.’ 


Naves would like to give a general piece of legal 
advice to ICT developers and policy makers: ‘Be as 
transparent as possible about what you do.’ 
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Cognitive robotics: 


By Bennie Mols Images lvar Pel 
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Rico Méckel 


At Maastricht University, 
the SwarmLab investigates 
how to build smart robots 


and other embodied AI 


systems from many much 


simpler components. 


Isolate a single neuron in the human brain, look at it under 

the microscope and attach the most advanced measuring 
equipment to it. But whatever you try, you will never under- 
stand human intelligence by simply studying isolated neurons. 
Intelligence arises from the cooperation between tens of 
billions of neurons. ‘Human intelligence can therefore be seen 
as a kind of swarm intelligence, a swarm consisting of neurons’, 
says Rico Mockel, associate professor for Cognitive Robotics 
and Intelligent Systems at Maastricht University. 


This idea of swarm intelligence is central to the research 
conducted by SwarmLab, which is part of the Department of 
Data Science and Knowledge Engineering (DKE) at Maastricht 
University. Mockel: ‘I’m interested in distributed intelligence, like 
in a swarm of neurons or a swarm of birds. And | believe that if 
you want to build smart robots and other embodied Al systems, 
which is our goal, then you must do this according to a similar 
swarm principle by letting the intelligence emerge from compo- 
nents that organise themselves into intelligent structures and 
societies.’ 


At SwarmLab, you can see experiments on swarms of drones, 
but also work on modular robots for use in education and work 
on smart prosthetics and brain-computer interfaces. ‘We have 
a broad view on what constitutes a robot’, says Méckel. ‘As far 
as we're concerned, a building equipped with sensors and 
actuators is also a robot.’ Starting from the scientific question 
of what makes a system intelligent, the researchers at 
SwarmLab look for human-friendly applications. M6ckel: ‘We 
aim to integrate our research into concrete products that 

really benefit people.’ 


To achieve this, SwarmLab works, for example, with the 
FieldLab Robotics in Roermond, a knowledge centre for 
companies, educational institutions and authorities in the field 
of industrial robotisation. SwarmLab is also working with TU 
Delft, TNO and the Port of Rotterdam on developing swarm 
intelligence for the port. 


The latest project that Mockel and his colleagues are working 
on is the European CoRoSect project in which cognitive robotics 
solutions are being developed for automated insect farms. 
Mockel: ‘The idea is to get rid of the inefficiency and waste in 
our current food chain by using protein-rich insects. They can 
provide a lot of food, and that can be done very efficiently if we 
rear them on a highly automated farm with smart robotics.’ 


Control by brain 


Kirill Tumanov, who is currently a researcher at Maastricht 
University within the project Combating Child Obesity, did his 
PhD research from 2015 to 2019 at SwarmLab. As a teenager in 
Yaroslavl (Russia), he dreamed of controlling machines using 
brain signals and building brain-computer interfaces. When he 
was studying for his master’s degree at Maastricht University, 
he started looking for a PhD project in which he could fulfil his 
dream. That turned out to be possible at SwarmLab, thanks to 
a collaboration with the neuroscience team of Bettina Sorger 


and Rainer Goebel at Maastricht University. ‘l was using 
functional near-infrared spectroscopy to read brain signals of 
participants and see whether they could control autonomous 
assistive robots. The idea is that in the future, people with a 
severe physical handicap could use this technology to indepen- 
dently interact with their environment.’ 


When Tumanov started in 2015, the SwarmLab group was in its 
infancy. He saw the group gradually grow. One of the keys to 
creating a sense of belonging in the research group was a 
journal club. Tumanov explains: ‘Every member of the lab would 
choose a scientific article that he or she thought would be of 
interest for everybody in the group, an article showing what is 
happening in the field. We would read the paper and discuss it 
together. This facilitated crossover between the different 
research directions.’ 


Feeling in prosthetic arm 


PhD student Lucas Dahl is a member of SwarmLab. He is doing 
research on a prosthetic arm. Wearers of current prosthetic 
arms cannot feel what they are grasping or touching. Dahl 
wants to take the next step: ‘We're investigating how a 


Group portrait 


Lucas Dahl | 


prosthetic arm can give a feeling to the wearer of that arm. 
What is unique about our prosthesis is that it has artificial skin, 
artificial muscles, and artificial intelligence.’ 


Dahl is still investigating how to distinguish between different 
types of tactile information entering the prosthetic arm. ‘I have 
a background in mechatronics. However, | know very little about 
Al. But that is the beauty of SwarmLab: we have people who are 
experts in Al, and | can make good use of their knowledge.’ 


The fact that he can easily supplement his own knowledge with 
the Al knowledge of other researchers in the SwarmLab was 
one of the main reasons why Dahl wanted to do his research at 
Maastricht University. ‘If you want to build cognitive robots that 
are aware of their surroundings, you have to combine mecha- 
tronics with Al.’ 


Besides a great diversity of scientific specialisms, SwarmLab 
also has a superb mix of nationalities. Dahl: ‘We have people 
from the Netherlands, Germany, China, Russia, India, Iran... One 
of our most enjoyable joint activities before the pandemic was 
going to the home of one of our colleagues and cooking 
something from his or her national cuisine.’ 
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Ton de Kok has been the director of CWI since 
2020. Before that, he was Professor of Quantitative 
Analysis of Logistical Management Problems at 
Eindhoven University of Technology, a position that 


he now holds part-time. After obtaining his PhD, he 


worked for 7.5 years as a consultant at Phillips. 


In conversation with 


THE STRENGTH 


OF CWI 


Ton de Kok, the new director of the national research institute for mathematics and computer 


science, Centrum Wiskunde & Informatica, has always taken a keen interest in real-life 
problems. ‘Applying the abstraction of mathematics to the chaos of real life is a challenge, but it 


yields great results.’ 


By Reineke Maschhaupt 
Image Elodie Burrillon 


How did you end up at CWI? 

‘After almost thirty years of being a professor 
at Eindhoven University of Technology, 

| was asked for this job. Following my PhD, 

| worked for a while at Phillips. Since then, 

| have retained a fascination for operational 
processes in industry throughout my 
academic career. Since 1946, CWI’'s mission 
has been to do fundamental research that 
benefits society. My approach fits in well 
with that. I'm not as surprised as others 
might be when confronted by the chaos of 
real life.’ 


What did you find at CWI? 

‘My vision is strongly oriented towards 
thinking as an outsider looking in. But you 
must first know where your strength lies. In 
February, we celebrated the 75" anniversary 
of CWI and that was fantastic, despite 
COVID-19. It was really well organised, in a 
professional studio. The people who work 
here are incredibly proud of the institute. 
I'm really impressed by how relevant the 
research done here is: cryptography, 
diagnostics for medics and energy issues. 
And very basic, but one of the most 
important challenges within computer 
science: storage and retrieval of data.’ 


How do you see the future of the 
institute? 

‘As an NWO Institute, we fulfil a national role 
within the research community of mathe- 
matics and computer science. Some people 
in that community think that we do not fulfil 
our national role well enough. | take that 
criticism seriously. With my management 
team, | am now making a tour of all mathe- 
matics and computer science departments 
in the Netherlands. | want to itemise the 
strengths of the entire research community 
so that | can reshape CWI's national role 
within it.’ 


What are CWI’s strengths? 

‘Quantum computing is currently an 
important subject. In 2015, CWI and the 
University of Amsterdam launched QuSoft, 
a research centre for quantum software. 
The work of several CWI researchers in the 
field of machine learning has acquired world 
fame. The same is true for cryptography 
and optimisation. In addition, we play a role 
in attracting young talent, which - after a 
thorough research training - we subse- 
quently send to the universities too. The 
Netherlands has many professors of 
mathematics and computer science who 
once spent some time working at CWI. We 
have a genuine incubator role.’ 
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DUTCH Al GOES 


On 9 April, the Dutch government announced the 
allocation of 1.35 billion euros from the National 
Growth Fund to five innovative programmes. One of 
those is the first phase of AiNed, an ambitious long- 
term investment plan to accelerate the development 
and application of Al in the Netherlands. 


The multiannual AiNed programme requires a total 
investment of 1.05 billion euros from the National 
Growth Fund over the period 2021-2027, with an 
equivalent sum also being jointly invested by 
private parties and standard public funds. During 
the first round of the National Growth Fund, an 
amount of 276 million euros has been allocated 
for AiNed's first phase. This is 80 percent of the 
requested budget. 


‘For a rapidly developing technology like artificial 
intelligence, it is impossible to predict what is 
needed six to eight years in advance’, says AiNed 
representative Inald Lagendijk, explaining the 
choice for breaking down the investment plan into 
three different phases. ‘So we decided to go for 

a learning by doing approach and to apply for 
funding for the first phase with activities starting in 
the coming two to three years.’ From the allocated 
budget for the first phase, 44 million euros can be 
spent right away on four dedicated instruments. 


First instruments 


To ensure a human-centred, responsible appli- 
cation of Al in society, dedicated ELSA (Ethical Legal 
Societal Aspects) labs will be set up. In these labs, 
companies, governmental organisations, 
knowledge institutes and citizens will work together. 
‘The focus of these labs is on studying how Al can be 
introduced into society in a socially acceptable way. 
Universities, companies and civil society organisa- 
tions can send in proposals to start up or scale up 
such labs. We are currently preparing the first call 
for proposals, which the Dutch Research Agenda 
will partially fund’, says Lagendijk. 


The second instrument that will be started soon is 
a dedicated Al Talent programme. Lagendijk: ‘We 
are still working out the details, but the aim is to 
attract and retain Al talent for the Netherlands by 
providing them with attractive start-up packages.’ 
The remaining two instruments are aimed at 
strengthening the Dutch Al position in Europe. 
‘We not only want to enable Dutch partners to 
join initiatives like CLAIRE and ELLIS, but also to 
strengthen their voices in these types of networks 
by providing them with some financial resources 
they can bring to the table.’ 


Two additional budgets 


If the programme demonstrates that it can spend 
the first 44 million euros wisely, it will be awarded 
an additional 44 million euros. The remainder of 
the 276 million euros allocated to AiNed is a reser- 
vation, subject to conditions. The original proposal 


Key changes 


describes twelve different instruments, not four. 
The remaining eight, aimed at ramping up 
education and establishing a chain approach for 
Al-innovation, need some additional clarifications 
before they can be granted. 


‘For the coming period, we have three priorities’, 
states Lagendijk. ‘First, we have to establish a 
governance model for the programme as a whole. 
Second, we need to find solid ways of spending the 
first 44 million wisely. And finally, we will start 
finetuning our plans for the remaining eight instru- 
ments to secure the additional 188 million euros 
that have been reserved for the AiNed programme.’ 


Researchers will be among the first to profit from 
this largest-ever investment in ICT innovation, 
Lagendijk anticipates. ‘I expect we will be able to 
open up the first calls for research proposals 
before the end of this year. Although we have not 
yet decided on the best way to do this, we will 
obviously make grateful use of existing expertise 
by involving organisations like the Dutch Research 
Council or the Netherlands Enterprise Agency. 
This success is the result of years of hard work by 
the Dutch Al community, Lagendijk says. ‘With the 
Netherlands Al Coalition (NL AIC) we created a 
strong network connecting over 400 parties. 
Together, we published a joint vision on “Al for the 
Netherlands”, which was embraced by the Dutch 
cabinet and led to its “Strategic Action Plan Al”. 

As a country, we have been lagging behind when it 
comes to investing in Al. With this funding, we will 
finally be able to catch up with our colleagues in 
Europe. Now the challenge is to deliver on our 
promise and use these funds to position the 
Netherlands among the worldwide frontrunners 
in the field of human-centred, responsible Al.’ 


BOOST FOR QUANTUM SOFTWARE 


In the first round of the National Growth Fund, a total of five 
proposals for projects designed to boost research and 
innovation have had € 1.35 billion of funding allocated and 
set aside for later use. AiNed is not the only ICT-related 


programme. Also Quantum Delta NL has been awarded 615 
million euros to coordinate and realise the Netherlands’ 
National Agenda for Quantum Technology. Besides the Delft 
research institute QuTech, the Dutch research centre for 
quantum software QuSoft is also one of the key partners in 
Quantum Delta NL, which will translate this grant into a 
tremendous boost for quantum software research. 
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Providing elderly people with the care 
S @) rt e S t they need within the healthcare 
network is incredibly complex. 


ime) u t e Therefore, this challenge is ideally 


suited for a modelling and analysis 


t O p TO p e r approach - tightly connected to 


domain expert input. The ‘Data-driven 


Cc rs | re Optimisation for a Vital Elderly Care 


System’ project (DOLCE VITA) is 


By Leendert van der Ent image iStock Starting to untangle the spaghetti. 


In the Netherlands, 800,000 people aged over 

65 years arrive at hospital accident & emergency 
departments annually. Many cases could have 
been avoided - if proper care had been given at 
the right time, at the right location. The mismatch 
between care supply and demand not only 
impacts patients. It also leads to unnecessarily 
high costs and discouraged professionals. 


‘We are conuinced this project will 
result in more regional grip on the 
healthcare system’ 


20 


All parties in a health network, from general 
practitioners to municipal health services, 
ambulance services and hospitals, have limited 
capacity. Parties are interdependent: interaction 
between two parties impacts all others. When a 
hospital closes - as happened in Amsterdam in 
2018 - it forces all network actors to rearrange 
their activities. 


Involved parties are well aware of this interde- 
pendence but do not know how it plays out. The 
DOLCE VITA project aims to unravel the supply 
and demand problems within the network. It does 
that by building an integral model for data 


analysis to answer “what if” questions that impact 
the system. The model should enable system 
tweaks to cut waiting lists or to forecast the 
necessary future building and bedding capacity. 


The inspiration for this research came from a 
previous project, in which Rob van der Mei and 
his team at CWI, together with TU Delft and VU 
University Amsterdam, developed an algorithm 
to minimise ambulance response times. Van der 
Mei, senior researcher and manager research 
and strategy at CWI and full professor in applied 
mathematics at VU University Amsterdam, 
comments: ‘We are aware that DOLCE VITA isn’t 
a mere mathematical exercise. We also need 
domain knowledge. Success depends on mutual 
learning. As scientists, we need to grasp the 
dynamics within the healthcare network.’ 


Oscar Smeekes, resident geriatric internist & PhD 
candidate at Amsterdam UMC adds: ‘It’s about 
building bridges. From our humanities/social 
sciences perspective, we learn how to look at the 
problem more logistically. It’s inspiring to learn to 
speak each other's language.’ Van der Mei: ‘The 
first year has taught all parties how to observe 
and define the network. That's vital. Whether a 
model is about patients, water or container flow, 
you have to understand how actors in it behave. 
Now we understand that, we can introduce 
domain knowledge in mathematics.’ 


Timing is crucial 
“The elderly” are a diverse group with fit and 
healthy pensioners alongside people with mental, 
physical, social and health literacy problems. 
Smeekes: This is highly relevant for healthcare 
demand. An affliction that keeps active elderly in 
bed for some days leads to long-term hospitali- 
sation for the less healthy. The right timing of 
care prevents people from sliding from the fit 
and healthy group to the group with much higher 
demand. Waiting lists can have harmful effects, 
and temporary solutions only increase demand. 
We know these things in general, but the actual 
consequences of specific interventions are 
unknown. The model will help to change that. We 
will know the shortest route to appropriate care.’ 


Quality of patient care is leading, and comes with 
bonuses, says Smeekes. ‘Effective healthcare is 
much cheaper and keeps healthcare profes- 
sionals happy too. Proper care means having 
sufficient time to do what is needed. These 
factors are therefore inextricably linked. ‘And 


Valorisation 


DOLCE VITA FACTS 


Duration: 
Budget: 


4 years total, 3 ahead 
€1,900,620 


Researchers: 10 - 15 researchers involved 


Project partners: CWI - project lead and beta perspective 
Amsterdam UMC - alpha/gamma perspective 


Sigra - spider in the web, sees to embedding in the 
sector and project adjustment 


Amsterdam Health Technology Institute (AHTI) - 
modelling and data analysis 


Fifteen healthcare institutions and health insurance 
companies - users 


what's more’, Van der Mei adds, ‘it’s easy to copy. 
Any other region can introduce its specific param- 
eters in the model. That's the beauty of it.’ 

‘The challenge of delivering the right care at the 
right moment at the right location is immense 
and complex’, concludes Robert Thijssen from 
project partner Sigra, the collaboration network 
for healthcare institutions in the Amsterdam, 
Zaanstreek-Waterland and Noord-Holland Noord 
regions. ‘We are now one year into DOLCE VITA 
and everybody involved is enthusiastic. We are 
convinced this project will result in more regional 
grip on the healthcare system: shorter waiting 
lists, and less administration.’ 
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HACK LIKE AN 
AGADEMICG 


‘Researchers find major 
vulnerability in Intel chips.’ 
‘A new wireless hack can 
unlock 100 million 
Volkswagens, scientists say.’ 
These are just two fairly 
recent headlines that 
described how Dutch 
academics exposed major 
ICT security issues. But what 
happens if you find such 
serious flaws in ICT systems? 


When it comes to scientific hacking, 
Bernard van Gastel, assistant 
professor in the Digital Security 
group at Radboud University, has a 
gripping story to tell. It all started 
with the proverbial Friday afternoon 
experiment. ‘We decided to take a 
solid-state drive (SSD) apart, just to 
see how it worked. My colleague 
Carlo Meijer soldered some wires 
to the processor of the SSD to read 
it out, and told me he had found 

A, and B, and a password check 
routine, ... | immediately knew that 
could be bad news. A password 
check routine is an indication that 
the password or key could be stored 
on the drive itself, which poses a 
major security threat. And indeed, 
within 1.5 hours, we had hacked 
ourselves in: we could decrypt all 
the data on the SSD without 
knowing the actual password.’ In the 
months afterwards, it turned out 
that the same problem occurred in 
drives of multiple manufacturers, 
which covered about two-thirds of 
the market. 


‘As scientists, we are mainly inter- 
ested in gaining new insights’, says 
Van Gastel as he explains why 


security researchers are actively 
searching for these types of vulner- 
abilities in the first place. ‘For the 
SSDs, there had been a suspicion 
that its hardware encryption might 
not be very robust and could be 
bypassed. We were the first to 
demonstrate this.’ 


Combining attack 
and defence 


Cybersecurity scientists can essen- 
tially be divided into two groups, he 
states. ‘Simply put: the defenders 
and the attackers. | come from the 
defence side. My PhD thesis, for 
example, describes how to prove that 
a piece of software is free of errors. 
Since Carlo is more of an attacker, 
with skills to attach wiring to 
hardware and readout chips, we 
complemented each other nicely.’ 


When searching for possible security 
leaks, you need a broad set of skills, 
Van Gastel says. ‘First of all, you need 
to know how software engineering 
works in practice to get an idea of 
typical mistakes one could make 
while developing an ICT system. 


ATTACK TO DEFEND 


The most recent version of National Cybersecurity Research Agenda explicitly men- 
tions developing attacks as a key component of Dutch Cybersecurity research. The 
Agenda argues that we cannot defend ourselves unless we understand what our 
weaknesses are and that designing attacks is essential to test designs and defensive 


measures. On the other hand, attacks can be used as defensive measures themselves 
when exploited to disrupt criminal activities. That is why Dutch researchers who work 
on defending our ICT and cyber-physical systems are just as busy developing attacks 
as they are designing defensive measures against malicious actions. 


For this, it is a major advantage if you 
have experience in implementing 
specifications. You should also be 
able to decompile software code to 
reverse engineer what it does. And 
you need some hardware skills so 
you can read out hardware and 
adjust the software it is running.’ 


Patience and 
perseverance 


If you want to convince manufac- 
turers to fix potential leaks, then 
this skillset is not complete without 
loads of patience and perseverance. 
The SSD issue was discovered in 
2016. It took until 2019 before the 
researchers were able to academi- 
cally publish their findings. ‘As soon 
as we found the SSD problem, we 
contacted the National Cyber- 
security Centre. That is a move 

| would recommend to anyone in 
our position. The NCSC took the 
heat off us and guided all of the 
negotiations with the manufac- 
turers. Initially, the companies 
involved only knew us as person A 


and person B. They didn’t even 
know where we worked.’ That was 
no exaggerated luxury since instead 
of welcoming you with open arms, 
manufacturers aren't very happy 
with people who expose their flaws. 
‘Our research group here in 
Nijmegen has been facing multiple 
lawsuits after exposing vulnerabil- 
ities in the chipcards produced by 
NXP that are used in access cards 
for buildings and public transport, 
and in the car keys from the 
Volkswagen Audi Group. These 
lawsuits have led to hundreds of 
thousands of euros in legal costs’, 


Van Gastel says with regret. 

For many companies, their first 
reflex still is to sue anyone who 
makes them aware of security 
issues. ‘In the Netherlands, if you 
give a company time to fix the 
problem before you go public with 
it, you are fairly safe. But in many 


other countries, that is not the case. 


One of my former colleagues 
involved in the car key research 
moved to the UK, where he was 
sued for the work he did here. That 
should not be possible.’ And in the 
context of the current recognition 
and rewards discussion, there is 
room for improvement as well, he 
says. ‘Disclosing ICT vulnerabilities 
takes up a hell of a lot of time, 
which reduces your output in terms 
of publications. But if research that 
prevents sensitive data from being 
stolen by the bad guys isn't 
beneficial to society, what is?’ 
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Clarisa Sanchez has been 
Professor of AI & Health at the 
University of Amsterdam since 
October 2020. Previously, 

she worked as an associatene 
professor at the Depa at of 
Radiology and Nuclear! i 
at Radboud university 
center. Since 2019, she h 
been the scientific director of 
Thira Lab. Sanchez received her 
PhD in telecommunications 
engineering from the University 
of, Valladolid in Spain. 


SYMBIOSIS BETWEEN 
DOCTORS AND AI 


By Reineke Maschhaupt Image lvar Pel 


The recently formed qurAl research group is a unique 
merger of the Informatics Institute of the University of 
Amsterdam and the Amsterdam Medical Center. ‘To 
change the system, you have to be part of it’, advocates 
co-chair of the group Clarisa Sanchez. 


‘During my former research, | noticed a disconnection 
between the fundamental research in artificial intelligence 
(Al) and its implementation in clinical practice. There was 
a lot of miscommunication about what is clinically useful. 
That was the reason to connect these fields in the qurAl 
group. We do not want to develop just solutions; we really 
want to incorporate those into the healthcare system too. 
| want patients to receive the best treatments possible. 
Right now, we are mainly focusing on the medical fields of 
ophthalmology, cardiology, oncology, radiology and intensive 
care. 


Doctors are increasingly open to the use of Al, but there is 
still a lack of knowledge. For example, there is always a fear 
of the system making an error. Then who is responsible? And 
what is the effect on the patient? The next step for doctors is 
to understand more about the technology. And to feel that 
they participate in the creation of Al models. The biggest 
misconception that Al experts have is that only data is 
important for creating a solution, whereas in reality, so many 
things must be taken into account to create clinically 
meaningful models. 


BUILDING BRIDGES 

The biggest challenge right now is connecting the many 
players involved in our research. These are not just Al 
experts and doctors but also software engineers, legal and 
ethical experts, regulatory bodies and insurance companies. 
The process of designing, developing, validating, testing and 
integrating novel technology has to become both easier 
and faster. One example of how we try to do that is the 
co-development of a Grand Challenge platform with 
Radboud university medical center, where all the different 
parties can meet, access the data and work together on 

the perfect solution. It is also a place where doctors can 
evaluate Al algorithms that mimic what is happening in 
clinical practice. 


In the future, | would like to see Al becoming integrated into 
clinical practice in perfect symbiosis with the doctor. Patients 
shouldn't even notice the presence of Al. It would be good if 
mergers like we have achieved in our research group, would 
happen more on a national level. Working in separate units is 
not the way to go.’ 


